![Worms Worms](http://a.fsdn.com/sd/topics/worms_64.png)
![Security Security](http://a.fsdn.com/sd/topics/security_64.png)
![Government Government](http://a.fsdn.com/sd/topics/government_64.png)
![The Courts The Courts](http://a.fsdn.com/sd/topics/court_64.png)
![News News](http://a.fsdn.com/sd/topics/news_64.png)
![IT IT](http://a.fsdn.com/sd/topics/it_64.png)
Zotob and Mytob Worm Authors Arrested 363
An anonymous reader writes "The Washingtonpost.com is reporting that two men have been arrested for allegedly authoring and releasing the "Zotob" and "Mytob" worms. The first Zotob, released Aug 14 - just 4 days after Microsoft released a fix for the hole it exploited, infected systems at many major news outlets. Mytob remains one of the most pervasive worms on the 'Net today." From the article: "Moroccan authorities, working with the FBI, arrested Farid Essebar, 18, a Moroccan national born in Russia who went by the screen moniker 'Diabl0.' Arrested in Turkey was Atilla Ekici, aka 'Coder,' age 21. Both individuals will be subject to local prosecutions, the FBI said." Update: 08/26 20:56 GMT by Z : Nana Mous wrote to mention an eWeek blow by blow account of Microsoft's response to the worm. Very interesting read.
Informative link: (Score:5, Informative)
Re:Informative link: (Score:5, Funny)
Re:Informative link: (Score:3, Funny)
The Worm Author Prison Haiku Blues (Score:3, Funny)
set loose to exploit your holes
mine left for inmates
With a name like... (Score:5, Funny)
Re:With a name like... (Score:2)
Punishment? Right... (Score:2, Funny)
In other words, a few horse heads will show up in some beds, some vague threats made, and they'll get off with no punishment.
Re:Punishment? Right... (Score:2)
Re:Punishment? Right... (Score:2)
Worm/virus authors are one notch above spammers. (They're only one notch above spammers because, unlike spam, I've never been hit with one.)
In other words - you're making the original poster's point. Spending their time locked into a cell with nothing but a bucket of their own feces for dinner, beaten regularly, and after a few month
Re:Punishment? Right... (Score:3, Insightful)
Third World Countries? (Score:3, Interesting)
i always wondered (Score:4, Funny)
and also, i guess this shows more than russia has some awesome programmers
last tid bit:
Moroccan authorities, working with the FBI, arrested Farid Essebar, 18, a Moroccan national born in Russia who went by the screen moniker "Diabl0."
who the hell uses the term 'screen moniker'??
Re:i always wondered (Score:5, Insightful)
Creating these viruses is easy. It takes a lot more skill to create a complex system than it does to find a crack in the foundation and exploit it. All that this really shows is that Russia has some 'unconscionable' programmers.
Re:i always wondered (Score:3, Insightful)
What, specifically, in the "code" of these viruses constitutes the "awesome" part?
IMoniker (Score:2)
COM programmers, perhaps?
Coder?? (Score:2, Insightful)
http://www.hyperhistory.net/apwh/bios/b3atilla_p1
Would you use your real name? (Score:2)
That, and... (Score:2)
Re:makes sense to me (Score:2, Funny)
Re:Coder?? (Score:2)
Fitting Punishment... (Score:4, Interesting)
Re:Fitting Punishment... (Score:3, Interesting)
Too lenient. How about they get wired up to some slashdot server and are delivered a slight electric shock every time some idiot writes "virii?" Two shots for "cracker" every time it is not used in the context of edible wafers.
Now, THAT's script-kiddie rehab!
Re: (Score:2)
Re:Fitting Punishment... (Score:3, Insightful)
THERE IS NO SUCH WORD AS VIRII.
THERE IS NO SUCH WORD AS VIRII.
THERE IS NO SUCH WORD AS VIRII.
Keep reading it, and try to let it sink in.
Morocco and Turkey? Bleh (Score:3, Insightful)
Re:Morocco and Turkey? Bleh (Score:2, Funny)
Re:Morocco and Turkey? Bleh (Score:2)
(in the mirror, that is scary enough)
Re:Morocco and Turkey? Bleh (Score:2, Interesting)
Welcome in Guantanamo !
Re:Morocco and Turkey? Bleh (Score:3, Insightful)
According to a quick Google on the (ever reliable) internet, there are political prisoners in the US, there is torture going on (not only Abu Graib and Guantanamo, see http://www.historiansagainstwar.org/resources/tor t ure/brucefranklin.html [historiansagainstwar.org] ) and there are also doubts on whether you can get a fair trial: it's often advised to expelled suspects that in their ow
Re:Morocco and Turkey? Bleh (Score:5, Interesting)
I am a Moroccan national, and I have partically renounced travelling to the US after all the horrors stories people I know have told me they have faced in US airports.
Morocco is not really a democratic country (yet), but things are slowly evolving in the good way and nothing similar to Abu Ghraib or Guantanamo has happened lately in Morocco, since Tazmamart which was really horrible for those who have heard about it.
how were they caught? (Score:5, Funny)
Re:how were they caught? (Score:5, Funny)
No no no, these days you've got to do it right... JavaDoc syntax!
Re:how were they caught? (Score:2)
It's a real shame (Score:5, Insightful)
ANYTHING. The lack of creativity in today's vandals is just pitiful.
Re:It's a real shame (Score:2)
Re:It's a real shame (Score:5, Insightful)
I'm still waiting for the virus that infects systems through vulnerabilities in IE or Outlook/OE, then:
- Installs Firefox
- Configures it to be the default browser
- Imports the IE favorites to the bookmarks,
- Edits the registry to disable IE as much as possible
- Installs Thunderbird
- Configures it to be the default email client
- Imports contents of Outlook and OE address book to Thunderbird
- Uninstalls Outlook Express and OE
- Deletes itself
The writer of this 'virus' should get a frickin' medal.Re:It's a real shame (Score:2, Insightful)
He's more likely to get beaten to death by people raking in the money from removing spyware and repairing viruses.
Re:It's a real shame (Score:2)
Monkeyboy, geeze, think of what you just said. You missed a propogation step! A worm really isn't a worm without it...
(also, OE and Outlook Express are the same thing - and they can't be uninstalled)
Re:It's a real shame (Score:5, Funny)
Re:It's a real shame - missing step (Score:2)
Uninstalls Outlook Express and OE
Sets FF and TB icons to resemble IE and OE for clueless users.
Deletes itself.
Happy Bithday, Joshi (Score:5, Funny)
Happy Birthday, Joshi.
Re:Happy Bithday, Joshi (Score:2, Interesting)
We do still have these. They're called freeware or shareware. You'll find them on websites all over the place. Most of the time they come with hidden surprises too!
Re:It's a real shame (Score:2)
Not that yesterday's vandals were any less pitiful.
Interesting the speed of things recently... (Score:3, Interesting)
I think it's interesting that when these worms were originally introduced, and started first infecting machines, how the media made such a big deal about how quickly after the security hole was announced the worm was unleashed. I find it a bit more interesting the speed with which law enforcement is able to nab the creator of such programs. It used to be, "We don't know where in the hell to start!" to now it's more like "When can we pick this person up and how are we going to prosecute them here or there."
Just my thoughts.Quick question. (Score:5, Insightful)
Re:Quick question. (Score:5, Informative)
Re:Quick question. (Score:2, Informative)
1) They very stupidly could have launched the worm from their own computer rather than a public computer say 50 miles away in a library somewhere.
2) They could have run the program when they compiled it for the final time by doing a compile and run versus just compile.
It's always something like that happens when these guys get busted. They get comfortable and forget to do something that they needed to cover their tracks due to lack of extreme paranoia.
Re:Quick question. (Score:3, Insightful)
Re:Quick question. (Score:2, Informative)
With such a connection to accounts, it's not a rocket science to catch writers. I think Turkish guy thought Turkey is heaven to do such things without any kind of anonymity in Turkey but evidently he was wrong.
Re:Quick question. (Score:2, Interesting)
AKA Coder? (Score:2, Funny)
What a bunch of shit (Score:5, Insightful)
Oh so the airport screening machines are on the internet, are they? I feel safer in the hands of people as competent as the DHS already...
Or more likely, this is just another piece of DHS propaganda designed to enphasize how dangerous those virus writers are. So dangerous they can disable our precious airport security systems! Terrorists!!
Re:What a bunch of shit (Score:4, Insightful)
Oh so the airport screening machines are on the internet, are they?
Or more likely, someone brought in an infected laptop and connected it to the network...
Not that it's a much better situation, but just because a computer (or network) has a virus on it, does not mean it's on the internet.
Re:What a bunch of shit (Score:2)
Oh so the airport screening machines are on the internet, are they? I feel safer in the hands of people as competent as the DHS already...
Or more likely, this is just another piece of DHS propaganda designed to enphasize how dangerous those virus writers are.
"Never attribute to malice that which is adequately explained by stupidity."
Infrastructure isn't cheap (Score:2)
The latter is a hell of a lot cheaper. And it's effective if you restrict what sorts of programs are used on the computer. Like there's no reason for these to have had port 445 open in the first place. (It's a hell of a lot easier to control open ports with Linux than with Windows.)
Restrict
Re:What a bunch of shit (Score:5, Interesting)
I can't speak for airports other than the one I worked at, but while the machines were capable of being networked, I saw no indication that they were actively used as anything but stand-alone machines. (That's not to say they weren't... just that I saw no indication of it.) To me it means that these machines aren't likely to have been infected unless a technician connected a laptop to it and inadvertently infected one. As much as I would like to bad-mouth DHS and the TSA, I can't in this area -- it just doesn't seem likely to me.
Now that said, I know all of their office systems are Windows and could have been vulnerable. But again, the systems at the airport I worked didn't have much in the way of network connections (most of the time, no network connection at all). So again, I don't think airport systems, administrative or operational were vulnerable to network infection.
Re:What a bunch of shit (Score:5, Insightful)
UPS is a commercial venture, they may have grave problems, but it's not a matter of national security.
The DHS on the other hand, given the important task of securing the homeland that they've been given, if they can't be trusted to use something other than Windows connected directly to the net to do their job, they should be kicked in the butt.
My suspicion however is that they're not that stupid, they probably do have secure systems and networks, and that's what leads me to deduce that the statement in TFA about kids half-way around the globe being able to disable airport security is a crock of shit. Either way, the DHS should be investigated, either for negligence, or for misleading the public.
FBI has become a world-wide police force. (Score:3, Interesting)
It is interesting that the U.S. government's FBI agency has become a world-wide police force.
--
Trying to make one book explain all of life makes some people crazy enough to kill.
Re:FBI has become a world-wide police force. (Score:2, Insightful)
I'm all in for all governments agencies to work together to hunt these people down.
Re:FBI has become a world-wide police force. (Score:4, Informative)
The FBI has Legal Attaché Offices in approximately 50 countries world-wide.
http://www.fbi.gov/contact/legat/legat.htm [fbi.gov]
Uhhh, what gave you that idea? (Score:5, Informative)
So, what probably happened here is what happens all the time, the FBI had evidence that one of the authors was Moroccan so they got a hold of Moroccan police and gave them the information they had. Moroccan police investigated and have now arrested a suspect.
I fail to see the problem here.
Re:FBI has become a world-wide police force. (Score:2)
Microsoft Assisted the Worm Investigation (Score:3, Informative)
New market for MS? (Score:2)
Re:New market for MS? (Score:3, Insightful)
I don't get it... (Score:2)
That, to me, would seem like the choice route.. instead they're mild "blah blah, I will infect you and do nothing but infect others" apps.
Shame..
Re:I don't get it... (Score:2)
Re:I don't get it... (Score:2)
Re:I don't get it... (Score:2)
The kid that wiped out 75% of America's computers would pretty much be (in)famous forever. You don't think that's an attraction? I'm amazed it hasn't happened already.
Re:I don't get it... (Score:2)
Re:I don't get it... (Score:2)
Re:I don't get it... (Score:2)
Key phrase: too soon. Imagine a worm that replicated for a day or so before cleaning house. It would spread almost as quickly as non-limited worms, but would inflict far, far more damage.
Re:I don't get it... (Score:3, Informative)
a) that would slow the rate of infection, and it's lifetime (I still see the odd laptop infected with blaster)
b) an infected machine they can pull credit card numbers off of (which they did in this case) or send spam with, is much more valuable to writers these days than just killing it.
wish viruses were more like these (Score:2, Funny)
GUY: SIR! WEVE GOT A COOKIE MONSTER!
other guy: TYPE COOKIE YOU IDIOT!
Just Hoping... (Score:2)
Hope that includes torture.
Funny Logic ... (Score:3, Insightful)
How is this wrong? People like this are keeping software developers on their toes. I say good on them...
Couldn't you make the same case for people shooting cops or driving drunk? In the first case it will spur body armor manufacturers to create more effective armor. In the later it may lead to safer cars?
Easy targets missed (Score:2, Interesting)
But, no Windows machine should have an uptime of more than ~6 months as all MS updates require a reboot. And the Netcraft list contained Win2k machines w/ 4+ yrs uptime! That means they should be ripe for the pic
From the eWeek update... (Score:4, Funny)
Damn, now I want to know what that subject line says...
very specific, high-priority subject line (Score:2, Funny)
The "Executive e-mail" is a key part of the response process, and it includes the use of a very specific, high-priority subject line to make sure the mail is read by the senior executives.
Unfortunately for Microsoft, and fortunately for us, that very specific, high priority subject line has been leaked:
Here's a lesson for all you future criminals (Score:2)
That's why we can't find Osama.
Re:Young (Score:5, Funny)
Re:Young (Score:2, Funny)
Yes, but their midochlorian count was through the roof. I hear tell that once they get off their prison sentence turning Wookie turds into Jedi lounge furniture, the Emperor will hire them as consultants.
Re:Young (Score:2, Insightful)
Re:This was the proper response. (Score:3, Interesting)
Re:This was the proper response. (Score:2)
You mean this isn't a Mac topic?
Re:This was the proper response. (Score:2)
Actually, it is. [slashdot.org]
Re:This was the proper response. (Score:2)
Re:It's Windows (Score:5, Insightful)
Re:It's Windows (Score:2)
Re:It's Windows (Score:3, Interesting)
Have you ever known an emperor to respond to the "oh, you made a mistake" approach? Or even recognize that a mistake has been made without a few rocks thrown at their balls? Plenty of people, security experts and script kiddies alike, have been warning with the "pointing" method for a long time. Absolutely no-one notices until the emperor takes a few rock
Re:It's Windows (Score:4, Funny)
Imagine that a clothing company uses very shoddy materials and cuts corners in its production, yet they are popular enough that 9 out of 10 people will be wearing that brand of clothing. The clothes are crap, sub-standard, and you just know that if people realized this, the company would either improve, or people would buy their clothes elsewhere. To that end, you walk down a busy street and grab a handful of cloth every which way, easily ripping the shirts off 9 out of 10 women who pass by you.
Should you be jailed for "merely" demonstrating this weakness?
-paul
Re:It's Windows (Score:2)
interesting...
Re:It's Windows (Score:3, Insightful)
Blame is not a zero sum game. Windows is one of the problems. A child who writes worms is another.
Re:Wow (Score:2, Insightful)
To further ammend that, the problem is not code reviews, it's the MS design (or lack thereof). Alot of MS exploits are not issues where the code was defective as much as where the design was defective. Take, for example, the Slammer worm. You would ask the SQlServer instance for a database (directory service over UDP), then get a good old buffer overflow by making a bad request (not formatted properly). (My memory is a bit rusty on the details, check out wired for a slightly closer look [wired.com].)
Code reviews,
Re:People should be thanking them.. (Score:2)
Re:Morocco and Turkey, eh? (Score:5, Informative)
Turkey and Morocco are amongst America's most trusted allies. Turkey is member of NATO, and Morocco was granted by the US the status of most important ally outside NATO, and we have a free trade agreement with Morocco as well.
Oh, and btw., America's oldest friendship treaty (non broken) with a foreign nation was with... right: Morocco. Signed on our side by Thomas Jefferson himself.
Re:Diabl0 & Coder should be given medals (Score:2)
Ones made of lead, and propelled at high velocity by smokeless gunpowder.
Re:Diabl0 & Coder should be given medals (Score:5, Insightful)
The exploit was for a patch MICROSOFT HAD ALREADY RELEASED. They were merely taking advantage of the hole that Microsoft revealed by making the patch available.
I fail to see how these guys deserve anything but the punishment they are getting.
Re:Asking for trouble... (Score:2)
No kidding. What's wrong with a mail rule that says "if message is PGP-signed by the security team, put in folder 'READ_NOW!' and play 'ALERT_SIREN.WAV'". Seems a lot less prone to accidents or abuse.
Re:So what's wtih CNN (Score:3, Informative)